Skip to main content

Losing the ISP privacy fight is only the beginning

Losing the ISP privacy fight is only the beginning


The FCC just opened the door to profound changes in the structure of the web

Share this story

Last night, the House of Representatives joined the Senate in a joint resolution to repeal the FCC’s recent privacy rules, leaving only President Trump’s signature before the rules are officially revoked. It was a shocking turn for advocates of the open web, rolling back rules intended to stop carriers from sharing personal web histories and using subscriber data for marketing. The EFF responded with nightmare scenarios of what would be permitted under the new rules, including ISP-injected pop-up ads or preinstalled spyware. At the same time, some conservative groups insisted nothing will change at all, arguing the same protections are already available through the Telecom Act and other privacy laws.

In some ways, the conservatives have a point. Congress didn’t pass any new laws on broadband privacy last night; it only repealed an Obama-era rule that hadn’t yet gone into effect. The repealed privacy rules aren’t the only protections against misconduct by your internet provider, and they aren’t even the FCC’s only means of cracking down.

One of the basic principles of the internet is that it’s the same no matter where you’re logging on

But while the immediate impact of the joint resolution may be hard to see, it paves the way for a much larger shift in FCC enforcement and, ultimately, the structure of the web itself. For decades, one of the basic principles of the internet has been that it’s the same no matter where you’re logging on. Now, carriers are getting the chance to tie your online activities closer to your real identity, drawing on the name and address you gave when you signed up for service. Under Chairman Ajit Pai, the FCC seems to have little interest in holding them back. That could have a profound impact on the nature of the web — and after today’s joint resolution, there may be no going back.

It’s hard to pin down the direct consequences of Congress’ latest move because, on a statutory level, little is changing. Wheeler’s Privacy Rules are being rolled back, but the rules never officially took effect, so there won’t be anything that’s legal after the repeal that wasn’t technically legal before. As long as Title II is still in effect, carriers are bound by law to keep consumer information private, and it’s up to the FCC to enforce that. Pai’s replacement rules are expected to roughly follow the FTC’s guidelines, which have been used in the past to crack down on both supercookies and smart TVs building ad profiles without user consent. On a strictly legal level, that authority is more than enough to crack down on some of the more alarming scenarios that have been raised, like selling individualized browsing histories or hijacking web requests to divert to advertising.

Carriers are challenging Google and Facebook’s stranglehold on the ad business

But that doesn’t mean this week’s panic was a false alarm, only that the damage is harder to spot. The FCC is still in charge of enforcing the rules of the road, but Ajit Pai’s FCC is taking a very different approach than Tom Wheeler’s FCC. Even before Title II, Wheeler was willing to take clear action against anything he saw as potentially anti-competitive — a list that ultimately included even zero-rated wireless data schemes. Pai’s approach promises to be much more permissive, and rolling back Wheeler’s privacy rules is the first concrete sign of that. It’s a clear signal to service providers that if they want to boost their ad business with consumer data, the FCC won’t stop them. 

In broad terms, that means carriers are getting into the online ad business, challenging Google and Facebook’s current stranglehold on the marketplace. The two companies capture an estimated 90 percent of every new dollar spent in online ads, and carriers have long seen government regulation as the only thing keeping them from capturing some of that money. As Pai’s supporters will point out, the online ad market market is already a duopoly, and adding new competitors to the mix could force everyone toward better ads and better practices. Google and Facebook have scale and technology on their side, while carriers have subscriber data. Even with the house advantage, it’s hard to know who will come out ahead.

But whoever wins, the result will be deep ties between the online and offline worlds. Unlike carriers, Facebook and Google don’t know who you are unless you tell them, and they have little insight into what you do outside of your devices. But carriers know your name, address, and payment info — they need to in order to deliver you service — and combined with data brokers’ vast store of purchase history, that can be used to track nearly everything you’ve done with a credit card. By now, we’re used to a product following us around in ads after we order it online — but carrier tracking means the same thing could happen with products you buy offline, as credit card purchase histories enter the mix.

There’s no going back

The shift could also have profound consequences for the structure of the internet, changes we’re already starting to see take shape. In the past 10 years, carriers have bought many of the largest ad-supported sites on the web, with AOL and Yahoo folding into Verizon and NBCUniversal folding into Comcast. Comcast has made significant investments into other web companies like BuzzFeed and Vox Media (parent company of The Verge), giving it an easy entry for advertising partnerships with huge portions of the web. That sets the stage for a lasting division between carrier-partnered sites and everyone else, with subscriber data giving partnered sites more data and more expensive ads. It would be a profitable setup for providers and their partners, but add a lasting tilt to the relatively level playing field of the web.

That kind of shift is hard to undo. It’s a question of rewriting business models and peeling apart entire corporations. Online ads have always been one of the most pervasive tracking systems on the internet, and adding subscriber data will only make it more powerful. Combined with media consolidation and looser regulations, it could shape the messy sprawl of the web into something much more controlled. It’s still too early to say where that process will leave us — but if the FCC’s recent moves are any indication, there’s no going back.

Disclosure: As mentioned in this article, Comcast is a minority shareholder in Vox Media, parent company of The Verge.